nanocore

General

Target

bbe396d18479f6b901f85d9decf310b7_JaffaCakes118
Size

558KB
Sample

240823-qkmw5awcqf
MD5

bbe396d18479f6b901f85d9decf310b7
SHA1

0cacced8f7f1bfd1e92672c0e5e73251738a55fb
SHA256

52b5f2f95b1200b20a6f3adfcb93c6f87713155f83176dede353ee158c7c1b63
SHA512

a4f96a80617c5c80db56b0e7efef0226a7aa9efb51d97c7c43c5e4efe116dd58f53ba0c09672ba75d4098b56dd0b917ac0e623bd5881db3329cce3877281301c
SSDEEP

12288:uKZyXwAn+xj4Br5oM/AIxwIeCFpsoaf70zKWmY8GdSFXu99/Wr06P3+I:JZyh+xj4USdsoa9Wrkou0q+I

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

91.193.75.252:83

fire4fire123.ddns.net:83

Mutex

1b394b53-fbc6-40e7-bf9e-2192e862fc8a

Attributes

activate_away_mode
true
backup_connection_host
fire4fire123.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-11-16T23:23:53.875058336Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
83
default_group
AA HHH
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
1b394b53-fbc6-40e7-bf9e-2192e862fc8a
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
91.193.75.252
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  bbe396d18479f6b901f85d9decf310b7_JaffaCakes118
- Size
  
  558KB
- MD5
  
  bbe396d18479f6b901f85d9decf310b7
- SHA1
  
  0cacced8f7f1bfd1e92672c0e5e73251738a55fb
- SHA256
  
  52b5f2f95b1200b20a6f3adfcb93c6f87713155f83176dede353ee158c7c1b63
- SHA512
  
  a4f96a80617c5c80db56b0e7efef0226a7aa9efb51d97c7c43c5e4efe116dd58f53ba0c09672ba75d4098b56dd0b917ac0e623bd5881db3329cce3877281301c
- SSDEEP
  
  12288:uKZyXwAn+xj4Br5oM/AIxwIeCFpsoaf70zKWmY8GdSFXu99/Wr06P3+I:JZyh+xj4USdsoa9Wrkou0q+I
Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1
  
  30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA256
  
  6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- SHA512
  
  f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP
  
  192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  9sb3l3p.dll
- Size
  
  13KB
- MD5
  
  53ae5d9d08ed7cf26f3b049bcfbe5d5f
- SHA1
  
  9a40de949997c3d677f2fcc0006ef2038b811719
- SHA256
  
  bbb240e248b69897a89e7246bb32554029da1ebe922dc54cf70b34892466aab5
- SHA512
  
  7b13f11b1fe3d2e52ed8a5b60c926af1133d5e0be129d2887e9a79f4fe20219abd8a586b2e89a6fbb53968fff668bd302cd2139de74268b73f336f171170edc9
- SSDEEP
  
  192:lW0fiRzjfIViPAshBiVldP3wo0rx9qaWAw5BXbOnC4jmIwwnv:HO5PAshkldP3grqa+MnCIwwnv
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
behavioral5 behavioral6